# CVE-2026-75135: UpSignOn for Windows sensitive data exposure in memory

Source: https://junglewise.ai/threats/cve-2026-75135-upsignon-for-windows-sensitive-data-exposure-in-memory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75135 · Severity: medium · CVSS 6.1 · Published 2026-09-02

UpSignOn is a password manager application for Windows that encrypts and stores user credentials in a vault. A vulnerability in versions before 7.19.0 allows local attackers with user-level access to extract the master password from the application's memory, even after the vault is locked. An attacker exploiting this flaw could decrypt and export all stored passwords and sensitive data in plaintext.

Technologies: [UpSignOn for Windows](https://junglewise.ai/threats/technologies/upsignon-for-windows). Vendors: [UpSignOn](https://junglewise.ai/threats/vendors/upsignon).

## Quick answers

**Is CVE-2026-75135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75135 being exploited in the wild.

**How severe is CVE-2026-75135?** Medium severity, with a CVSS score of 6.1, published 2 September 2026.

**Which products and versions are affected?** UpSignOn for Windows before 7.19.0.

**Is there a fix for CVE-2026-75135?** A patch was published on 2026-08-05: Version 7.19.0 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75135 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-75135?** Check whether you run UpSignOn for Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from improper memory handling in UpSignOn.exe, where a backup encryption key is retained in process memory and not securely cleared after use. An attacker with local access and standard user privileges can read the process memory to extract this backup key, then use it to decrypt the master password backup stored in the v6-vault1.DATA.txt file. Once the master password is recovered, the attacker can unlock the entire vault and export all stored credentials. This is a cleartext storage in memory vulnerability (CWE-316) that requires local access but can be performed without administrator rights or user interaction.

## Affected products

- UpSignOn UpSignOn for Windows before 7.19.0

## Timeline

- 2026-09-02: disclosed
- 2026-08-05: patched: Version 7.19.0 released with security fixes

## References

- [https://upsignon.eu/en/resources/release-notes/app](https://upsignon.eu/en/resources/release-notes/app)
- [https://www.vulncheck.com/advisories/upsignon-sensitive-key-retention-in-memory](https://www.vulncheck.com/advisories/upsignon-sensitive-key-retention-in-memory)

## Related threats

- [UpSignOn for Windows sensitive data exposure in process memory](https://junglewise.ai/threats/cve-2026-75137-upsignon-for-windows-sensitive-data-exposure-in-process-memory)
- [UpSignOn for Windows insecure credential storage](https://junglewise.ai/threats/cve-2026-75136-upsignon-for-windows-insecure-credential-storage)